ActiveMQ End of Life: Which ActiveMQ Versions Are Supported

As of October 2026, Apache supports two ActiveMQ Classic series: 6.3.x and 5.19.x. Every older Classic series, including 5.15, 5.16, 5.17, 5.18 and 6.0 to 6.2, is marked Inactive on the project's download page, which means end of life with no further updates. ActiveMQ Artemis publishes no support window at all: only its current release, 2.57.0, is offered for download. The status below is from the Apache ActiveMQ and Artemis download pages and the Classic security advisories, checked on 12 October 2026.

How ActiveMQ decides a version is end of life

Apache sets no fixed end-of-life dates for ActiveMQ Classic. The download page marks every release series Active or Inactive. Active means the series is supported and recommended for production, and receives community releases with new features, security patches and bug fixes. Inactive means the series has reached end of life, is no longer maintained, gets no updates, and is not recommended for new deployments. Because there is no calendar, the table on the download page is the only reliable check, and a series can move to Inactive between two of your patch windows.

ActiveMQ Classic status by series

Checked against the Apache ActiveMQ Classic download page on 12 October 2026. The last 5.18 release, 5.18.7, dates from March 2025. The 6.2 series was still receiving security fixes this year, for example 6.2.7, and is now listed as Inactive, so a series can lose support while recent advisories still name it.

ActiveMQ 6.x vs 5.x: why the next step is not always small

The two Active series are very different upgrades. Classic 6.x needs Java 17 and moves the broker to Jakarta Messaging, so code that imports javax.jms has to change, and 6.3 bundles Spring 7 and Jetty 12 where 5.19 bundles Spring 5.3 and Jetty 9.4. The 5.19.x series keeps the javax broker API and runs on Java 11, and its client can use Jakarta JMS 2 as well. For an estate on 5.15 to 5.18, 5.19.x is therefore the smallest step that gets security fixes back; 5.15 and 5.16 run on Java 8, so that step also means a Java 11 runtime. The 6.x move is a second project, covered in the ActiveMQ Classic vs Artemis comparison and the ActiveMQ modernization guide.

ActiveMQ Artemis: no end-of-life dates, but fixes land in the newest release

Artemis is a separate broker under the same Apache name, now published at artemis.apache.org. Its download page offers one release, 2.57.0 of 9 September 2026, which needs Java 17 or later, and we found no published support window or end-of-life dates for older releases. New releases arrive often: 2.55.0, 2.56.0 and 2.57.0 shipped on 29 June, 27 August and 9 September 2026. The practical reading is that any Artemis release other than the newest has no stated period in which a fix will reach it, so an estate pinned to an older 2.x release is carrying the same risk as an Inactive Classic line.

What running an end-of-life ActiveMQ version risks

CVE-2023-46604 is the example. A flaw in the OpenWire marshaller let a remote attacker with network access to a broker run shell commands by manipulating serialized class types. NVD scores it 10.0, and CISA added it to the Known Exploited Vulnerabilities catalogue on 2 November 2023 with known ransomware campaign use. Apache fixed it in 5.15.16, 5.16.7, 5.17.6 and 5.18.3 and told users to upgrade both brokers and clients. Those lines were patched for that flaw. For later flaws they are not: of the 25 advisories with 2026 CVE numbers on Apache's Classic security page, the ones we checked name fixes in 5.19.x and 6.x only. CVE-2026-34197, authenticated remote code execution through the Jolokia endpoint, is fixed in 5.19.4 and 6.2.3. CVE-2026-50734, a pre-authentication OpenWire denial of service, is fixed in 5.19.8 and 6.2.7. Both list every earlier version as affected, and 5.18 and older will not get a patched release from Apache.

• Security fixes stop. A new advisory lands in 5.19.x and 6.x and stays open everywhere else.
• Bundled libraries age with the broker. 5.15 ships Log4j 1.2.17, and Log4j 1.x has been end of life since August 2015.
• Audits flag it. An unsupported broker on the path of payment or order traffic is a finding in most regulated environments.
• The upgrade path gets longer. Each year on 5.x adds more to read before the move to 5.19 or 6.3.

The incidents that show up on older ActiveMQ brokers

• Producer flow control stalls. A destination hits its memory limit, or the broker hits its systemUsage limits, and producers block or receive a JMSException. The cause is almost always a slow or stalled consumer behind the destination.
• KahaDB data files that never shrink. A data file stays on disk while it holds a pending message, or an acknowledgement for a message in another file that is still in use, so one stuck message can pin the journal until the store usage limit blocks the broker.
• Exposed management surface. The web console and Jolokia API on port 8161 and OpenWire on 61616 end up reachable from networks they should not be. CVE-2024-32114 recorded that the 6.x default configuration left the Jolokia and REST API context unauthenticated before 6.1.2.
• Network-of-brokers links that drop. A broken link between brokers leaves messages stranded on the wrong side until someone notices.

None of these is caused by end of life. What end of life changes is that a fix, if the broker needs one, will only ever ship in a series you are not running. That is the case for having ActiveMQ support in place on the version you have while the upgrade is planned.

Your options

• Keep the version you run, and keep it patched. OSSeva, AceMQ's extended support platform, ships signed, backported CVE patches for ActiveMQ Classic 5.15, 5.16, 5.17 and 5.18, with priority on the OpenWire and STOMP transports, so the broker stays on the line your integrations already work with. For Artemis, OSSeva's coverage page lists 2.28.x to 2.32.x. OSSeva does not list patched builds for Classic 6.0 to 6.2, which Apache has also marked Inactive, so those should move to 6.3.x. Coverage is as listed on OSSeva's pages, last reviewed 29 September 2026, and every Classic version with its end-of-life status is on the OSSeva ActiveMQ Classic EOL page.
• Upgrade to a supported series. 5.19.x for the smallest change, 6.3.x if you can take Java 17 and Jakarta, or a planned move to Artemis, which has a different store, clustering model and configuration. If the question is whether to stay on ActiveMQ at all, see ActiveMQ vs RabbitMQ.
• Move to a managed service. Amazon MQ for ActiveMQ upgrades brokers automatically after a version reaches end of support. Its calendar shows 5.15 ended on 16 September 2024, 5.16 on 15 November 2024 and 5.17 on 16 June 2025, with 5.19 the recommended version.
• Get support for the version you run. AceMQ provides 24/7 ActiveMQ support for Classic and Artemis on any version, with a 15-minute emergency SLA, and plans the upgrade with you. For how the support market works, see ActiveMQ support options.

Start by finding out what you have. Check the activemq-broker jar name under lib/ on each broker host, or read the BrokerVersion attribute of the broker MBean over JMX. Then list every application that bundles an activemq-client jar, because the CVE-2023-46604 advisory said to upgrade clients as well as brokers. That inventory decides which of the options above is realistic. For the other technologies AceMQ and OSSeva cover past end of life, see end-of-life software support.

• Apache ActiveMQ Classic: Download and series status
• Apache ActiveMQ Classic: Security advisories
• Apache ActiveMQ: CVE-2023-46604 announcement
• Apache ActiveMQ: CVE-2026-34197 announcement
• Apache ActiveMQ: CVE-2026-50734 announcement
• Apache ActiveMQ: CVE-2024-32114 announcement
• Apache ActiveMQ: Producer flow control
• Apache ActiveMQ: Why do KahaDB log files remain after cleanup
• Apache Artemis: Download
• NVD: CVE-2023-46604
• CISA: Known Exploited Vulnerabilities catalog
• Apache Logging Services: Log4j 1.2 end of life
• AWS: Amazon MQ for ActiveMQ engine versions
• OSSeva: ActiveMQ Classic extended support
• OSSeva: ActiveMQ Artemis extended support
• OSSeva: ActiveMQ Classic end of life dates